owasp-amass/amass · error

failed to obtain the registered CIDR Netblock for: %s

Error message

failed to obtain the registered CIDR Netblock for: %s

What it means

getRegisteredNetblockEntity looks up the netblock entity in the graph by filtering entities of type oam.Netblock on content cidr == iprec.CIDR.String(). If the query does not return exactly one match, the registered netblock entity cannot be linked and this error is returned. It is the netblock counterpart of the registered-domain lookup and guards scope relationship creation.

Source

Thrown at engine/plugins/horizontals/plugin.go:511

	return nil, fmt.Errorf("failed to obtain the registered domain name FQDN for: %s", dr.Domain)
}

func (h *horizPlugin) getRegisteredNetblockEntity(sess et.Session, record *dbt.Entity) (*dbt.Entity, error) {
	iprec, valid := record.Asset.(*oamreg.IPNetRecord)
	if !valid {
		return nil, errors.New("failed to cast the IPNetRecord")
	}

	ctx, cancel := context.WithTimeout(sess.Ctx(), 30*time.Second)
	defer cancel()

	if ents, err := sess.DB().FindEntitiesByContent(ctx, oam.Netblock, time.Time{}, 1, dbt.ContentFilters{
		"cidr": iprec.CIDR.String(),
	}); err == nil && len(ents) == 1 {
		return ents[0], nil
	}

	return nil, fmt.Errorf("failed to obtain the registered CIDR Netblock for: %s", iprec.CIDR.String())
}

View on GitHub (pinned to 79299dce87)

Solutions

1. Ensure netblock entities are inserted before IP records referencing them, or create the netblock entity on demand here.
2. Verify the CIDR string representation is identical at insert and query time (use ipnet.CIDR.String() consistently).
3. Deduplicate netblock entities so exactly one exists per CIDR.
4. Log the underlying FindEntitiesByContent error to separate storage failure from genuinely missing data.
5. Fall back to len(ents) >= 1 taking the first entity if duplicates are acceptable.

Example fix

// before
if ents, err := sess.DB().FindEntitiesByContent(ctx, oam.Netblock, time.Time{}, 1, dbt.ContentFilters{"cidr": iprec.CIDR.String()}); err == nil && len(ents) == 1 {
	return ents[0], nil
}
return nil, fmt.Errorf("failed to obtain the registered CIDR Netblock for: %s", iprec.CIDR.String())
// after
ents, err := sess.DB().FindEntitiesByContent(ctx, oam.Netblock, time.Time{}, 1, dbt.ContentFilters{"cidr": iprec.CIDR.String()})
if err != nil {
	return nil, fmt.Errorf("failed to obtain the registered CIDR Netblock for: %s: %w", iprec.CIDR.String(), err)
}
if len(ents) == 0 {
	return nil, fmt.Errorf("registered CIDR netblock entity not found for: %s", iprec.CIDR.String())
}
return ents[0], nil

if iprec.CIDR == nil || iprec.CIDR.String() == "" {
	return fmt.Errorf("missing CIDR on netblock record")
}

iprec, ok := record.Asset.(*oamreg.IPNetRecord)
if !ok {
	// not an IP net record
}

netEnt, err := getRegisteredNetblockEntity(sess, record)
if err != nil {
	// log and continue; scope link is optional
	return nil
}

When it happens

Trigger: sess.DB().FindEntitiesByContent(ctx, oam.Netblock, time.Time{}, 1, {"cidr": iprec.CIDR.String()}) errors, returns 0 entities (netblock never discovered/stored), or returns multiple entities matching that CIDR string, when called from processInScope/processIPNetRecord.

Common situations: Processing an IP whose netblock record has not yet been stored (discovery ordering); CIDR string format mismatch (e.g., /32 vs single IP normalization) between records; duplicate netblock entities from multiple data sources; DB query failure.

Understand the failure class

Background: "Not found" and "does not exist" errors: why "Task not found", "No such folder", and "Can't find" fire when a lookup comes back empty — this error's family across 14 libraries.

Related errors

• failed to cast the IPNetRecord
• failed to create the OAM Service asset
• failed to create the Organization asset
• failed to create the edge
• no PTR records found for %s

AI-assisted analysis of owasp-amass/amass@79299dce87 (2026-09-06). Data as JSON: /api/errors/fe23d9988d13a306. Report an issue: GitHub.